dump traffic on a network

# man tcpdump

Options
-A     Print each packet (minus its link level header) in ASCII.  Handy for capturing web pages.

-i     Listen on interface.  If unspecified, tcpdump searches the system interface list for the lowest numbered,
       On  Linux  systems  with 2.2 or later kernels, an interface argument of ``any'' can be used to capture
       packets from all interfaces.

-r     Read packets from file

-w     Write the raw packets to file rather than parsing and printing them out.
-n     Don\'t convert host addresses to names.  This can be used to avoid DNS lookups.
-X     Print each packet (minus its link level header) in hex and ASCII.
-s     Snarf snaplen bytes of data from each packet rather than the default of 68 
       (with SunOS’s NIT, the minimum is actually 96).

       -D
       --list-interfaces
              Print the list of the network interfaces available on the system and on which tcpdump
              can  capture  packets.   For  each network interface, a number and an interface name,
              possibly followed by a text description of the interface, is printed.  The  interface
              name or the number can be supplied to the -i flag to specify an interface on which to
              capture.

tcpdump -i eth1   <-  eth0 is default interface. tcpdump searches the system interface list for the lowest numbered,
tcpdump -i any    <-  survey with all interfaces


tcpdump -n host 192.168.1.10
tcpdump -n -Xs 1000 dst host 192.168.1.10
tcpdump -n -Xs 1000 src host 192.168.1.10

not optin

tcpdump -n  not port 22
tcpdump -n  not arp and not port 22
tcpdump -n  not arp and not port 123 and not port 22
tcpdump -n  not host 192.168.100.10

tcpdump -n udp port 53 -i any  <- Check DNS
tcpdump -n port 53 -i any  <- Check DNS

tcpdump -vvv -s0 -l -n port 53
tcpdump -i eth0 -nxXs 1600 port 53

ss -anu

-A Print each packet (minus its link level header) in ASCII.

tcpdump -s0 -A dst port 80

tcpdump -A host 192.168.0.10 and \(port 20 or port 21\)

tcpdump -A host 192.168.0.10 and port 23

-w Write the raw packets to file rather than parsing and printing them out.

tcpdump -s 0 -n host 192.168.0.10 -w test.pcap
tcpdump -n host 192.168.0.10 and \(port 80 or port 443 \) -w test.pcap

tcpdump -n -Xs 1000 port 20 or port 21 or port 80 or port 443 -w test.cap

-r Read packets from file

tcpdump -r /tmp/20110615.pcap ← -r : Read packets from file